A broad online child safety bill cleared the U.S. House with strong bipartisan support, but the very mechanisms designed to protect minors from harmful content may end up eroding the privacy and free expression rights of every American adult who goes online. The Kids Internet and Digital Safety (KIDS) Act passed 267 to 117, making it one of the most sweeping federal efforts to regulate the digital experiences of users under 17. Civil liberties advocates argue the bill's structural logic - not its stated intentions - is what makes it dangerous.
What the KIDS Act Actually Does
The 114-page legislation bundles several existing proposals into a single framework. Platforms would be required to block users under 17 from accessing sexually exploitative material, financial scams, and content promoting the sale or use of alcohol, tobacco, narcotic drugs, and gambling. Beyond content restrictions, the bill prohibits collecting data on minors for targeted advertising, bans market research on minor users, mandates disclosures when users interact with AI chatbots, limits design features engineered to encourage compulsive use, and requires platforms to offer parental controls.
The bill's sponsor, Rep. Brett Guthrie (R-Ky.), described it as "the strongest approach to protecting kids online that Congress has ever seen." That framing reflects genuine legislative ambition. The problem, critics say, lies not in the goals but in the mechanism the bill creates to achieve them.
The Age Verification Problem Nobody Wants to Name
The KIDS Act does not explicitly mandate age verification. But it applies its protections whenever a platform "knows or should have known" that a user is under 17 - a deliberately low evidentiary threshold that effectively compels platforms to verify everyone. If a minor accesses restricted content on a platform that failed to confirm ages, that platform faces legal liability. The rational corporate response is to require proof of age from all users, regardless of whether the law technically demands it.
Joe Mullin, a senior policy analyst at the Electronic Frontier Foundation, put the consequence plainly: adults will be required to prove they are adults. In practice, that means submitting government-issued identification - driver's licenses, passports - or undergoing facial recognition analysis just to access ordinary online content. Those documents would then be stored in centralized databases maintained by private companies, which are routine targets for both criminal hackers and state-sponsored intrusion. "Once you're able to crack into a database with 45,000 IDs, there's a lot of mischief you can do," Mullin said.
The risk is not hypothetical. Large-scale data breaches have exposed the personal information of hundreds of millions of people across industries far more regulated than social media. An internet that requires identity verification to function is one in which the failure of a single corporate database can compromise the real-world identities of its entire user base.
Surveillance Advertising Fills the Gap Federal Law Leaves Open
A second, less discussed problem flows from the absence of a comprehensive federal data privacy law. The KIDS Act would restrict the collection and use of minors' data for targeted advertising. But once a user is confirmed to be 18 or older, no equivalent protection applies. The result, Mullin argues, could actually accelerate the commercial surveillance apparatus for adults rather than constrain it.
If platforms are required to know exactly how old every user is - to comply with age-gating requirements - they will build more precise demographic profiles than currently exist. That precision benefits surveillance advertising directly. "They will know exactly what age you are, because they'll have to," Mullin said. Advertising systems that already track browsing behavior, location, purchase history, and social connections would gain a new, legally mandated data point: verified age. Data brokers - companies that aggregate personal profiles and sell them to third parties, including federal agencies - would have access to increasingly detailed records of adult Americans with no federal ceiling on how that information can be used or resold.
This is not a marginal concern. The data broker industry operates largely outside public scrutiny, and the information it compiles has been purchased by law enforcement and intelligence agencies as a way to access records that would otherwise require a warrant.
Free Speech Implications That Extend Beyond Obvious Cases
The content restriction provisions raise a separate set of concerns. The KIDS Act bars minors from accessing material that promotes "the distribution, sale, or use" of alcohol, narcotics, tobacco, and gambling. The language is broad enough to encompass a wide range of speech that serves entirely legitimate purposes.
Mullin raised several concrete examples: a discussion forum where someone expresses concern about a family member's drinking, a community space for addiction and recovery, a harm-reduction platform where people share accurate information about drug interactions. All of these involve some discussion of substance use, and all of them would fall within the zone of content that platforms might restrict - or require age verification to access - under the bill's framework. "That's all clearly lawful speech, including speech for minors," Mullin said.
The chilling effect is structural. Platforms uncertain about where the legal line falls will err toward over-restriction. Users seeking health information, peer support, or honest discussion of difficult subjects will encounter walls that exist not because the content is harmful, but because the liability risk is not worth tolerating.
Mullin and the EFF are not opposed to protecting children online. Their argument is that the current bill solves the wrong problem with the wrong tools. Banning surveillance advertising for all users - not just minors - would eliminate the commercial logic that makes age verification necessary in the first place. Reforming the Computer Fraud and Abuse Act to allow third-party parental control applications to function without being sued by the platforms they monitor would expand parents' practical options. These solutions are less visible, less dramatic, and require confronting well-funded industry lobbying. That, Mullin suggested, is precisely why they remain unintroduced.
